Re: Missing public keys in aptitude - SOLVED (Sarge debmirror case)
Daniel Barclay wrote:
Florian Kulzer wrote:
[...]
Therefore I think it will be enough to import the signing key with gpg:
gpg --keyserver keyring.debian.org --recv-keys 2D230C5F
(with 2D230C5F being the key ID of the 2006 archive signing key), as
long as you run this command as the same user who will later run
debmirror.
I hope this works.
Yes, that seems to have worked (with the modification that for Sarge
it's the key with ID 4F368D5D ("Debian Archive Automatic Signing Key
(2005) <ftpmaster@debian.org>").
Thanks for pointing that out. I had not even considered that the 2005
key might also be missing. An important thing to keep in mind if
somebody asks that question again - which will probably happen in a few
days ;)
When will I need to get a new key (regarding Sarge)? For example,
if/when 3.1r2 is created, will its Release.gpg file be signed using
the 2005 key (the key that was current when Sarge was first released
(3.1r0)), or will it be signed using the key that is current when
3.1r2 is released?
As far as I understand it, the signing process is automated, therefore I
would expect that all new security updates to Sarge will be signed with
the 2006 archive key. Furthermore, the 2005 key expired 3 days ago. If
Etch is released as planned then the next key update will be handled
automatically in January 2007 (using the 2006 key to validate the new
2007 key).
Regards,
Florian
Reply to: